Free OffSec Threat Hunter (OSTH) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the OffSec Threat Hunter (OSTH) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A hunter needs to identify which process initiated a suspicious TCP connection. Sysmon network events are enabled. Which event type directly provides the connection and process linkage?

   1. A.Event ID 3: Network connectionCorrect answer: A
   2. B.Event ID 1: Process creation
   3. C.Event ID 11: File creation
   4. D.Event ID 22: DNS query

   Explanation: Microsoft states: "Each connection is linked to a process through the ProcessId and ProcessGuid fields." Event 3 records TCP/UDP connections and ties them to a process; the other event types record different activities.

   Reference: Sysmon — Events / Event ID 3: Network connection

2. 2A threat-hunt report states its conclusions but omits the SIEM searches and screenshots used to derive them. Which revision addresses the OSTH Hunt Narrative requirement?

   1. A.Include screenshots only for the last search and omit the queries.
   2. B.Include every query but omit the SIEM screenshots.
   3. C.Include all relevant screenshots and the queries used for findings.Correct answer: C
   4. D.Include screenshots for every search but omit the query text.

   Explanation: The OSTH guide says: "In the Hunt Narrative section, you must document your findings with all relevant screenshots from the SIEM and the queries you used to determine the attacker’s actions." Conclusions alone do not provide that evidence.

   Reference: OSTH Exam Guide — Section 1 / Documentation Requirements

3. 3A hunter is investigating a suspicious executable and needs the full command line used when it started. Which Sysmon event type is designed to capture process creation?

   1. A.Event ID 11: FileCreate
   2. B.Event ID 1: Process creationCorrect answer: B
   3. C.Event ID 5: Process terminated
   4. D.Event ID 3: Network connection

   Explanation: Microsoft says: "The full command line provides context on the process execution." This appears under Event ID 1, the process creation event; the other events capture file creation, process termination, or network connections.

   Reference: Sysmon — Events / Event ID 1: Process creation

4. 4A report includes screenshots and searches, but it skips the reasoning and intermediate steps between results. What property of the hunt narrative is most directly impaired?

   1. A.The reader can infer every omitted transition from the final conclusion.
   2. B.The reader can reconstruct the omitted steps from the search names alone.
   3. C.The reader can reproduce each omitted decision from the screenshots alone.
   4. D.The reader cannot reconstruct how each result led to the next.Correct answer: D

   Explanation: The guide requires: "This documentation should be detailed enough for a technically competent reader to replicate your analysis step-by-step." Missing intermediate steps prevent the reader from reconstructing the analysis.

   Reference: OSTH Exam Guide — Section 1 / Documentation Requirements

5. 5A hunter wants to investigate whether a process queried an attacker-controlled domain, including unsuccessful and cached queries. Which Sysmon event type should the hunter examine, if available on the host?

   1. A.Event ID 1: Process creation
   2. B.Event ID 3: Network connection
   3. C.Event ID 22: DNSEventCorrect answer: C
   4. D.Event ID 11: FileCreate

   Explanation: Microsoft states: "This event is generated when a process executes a DNS query, whether the result is successful or fails, cached or not." Event 22 records this activity; the other event types record different behavior.

   Reference: Sysmon — Events / Event ID 22: DNSEvent (DNS query)

6. 6An analyst discovers several attacker actions during a hunt. How should the Findings section of the OSTH report present them?

   1. A.Include each detected attacker activity in a timeline.Correct answer: A
   2. B.Include only the last detected activity in a timeline.
   3. C.Include the activities solely as an unordered IoC list.
   4. D.Include only activities that caused confirmed data loss.

   Explanation: The guide states: "Additionally, you must include each detected attacker activity in a timeline in the Findings section." Restricting it to the last or highest-impact activity omits detected actions.

   Reference: OSTH Exam Guide — Section 1 / Documentation Requirements

7. 7A hunter finds no Sysmon Event ID 3 records and has not checked the host configuration. What does the default configuration imply for the investigation?

   1. A.Only inbound connections are collected by default.
   2. B.Both inbound and outbound connections are collected by default.
   3. C.Only outbound connections are collected by default.
   4. D.Network connection collection is disabled by default.Correct answer: D

   Explanation: Microsoft states about the network connection event: "It is disabled by default." The hunter must check whether network connection monitoring was configured before treating missing records as evidence of no connections.

   Reference: Sysmon — Events / Event ID 3: Network connection

8. 8An intrusion detection alert is the only evidence currently associated with a suspected attack. How should the analyst describe the finding before validating it?

   1. A.As a confirmed attack, because IDS alerts cannot be false positives
   2. B.As an alert requiring validation, rather than a confirmed attackCorrect answer: B
   3. C.As benign activity, because an IDS alert alone cannot be conclusive
   4. D.As a confirmed compromise of every host on the network

   Explanation: NIST states: "IDS software does produce false positives, so IDS alerts should be validated." Until supporting evidence is assessed, the report should identify the observation and avoid asserting a confirmed outcome.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 6.4 / IDS Software

9. 9A Splunk search returns authentication events with a populated host field. Which command produces a separate event count for each host?

   1. A.| stats count BY hostCorrect answer: A
   2. B.| stats count
   3. C.| stats values(host)
   4. D.| stats count BY user

   Explanation: Splunk states: "If a BY clause is used, one row is returned for each distinct value specified in the BY clause." Grouping by host gives the requested per-host counts; omitting BY produces an overall count, grouping by user changes the grouping, and values lists hosts without counting events per host.

   Reference: stats — Description

10. 10An analyst wants to use a custom report template for an OSTH threat-hunt report. What condition does the official guide place on using it?

    1. A.The report omits the narrative whenever an executive summary is included.
    2. B.The report reproduces the suggested template's example incident verbatim.
    3. C.The information is structured and professional and meets the other requirements.Correct answer: C
    4. D.The report contains only a timeline and no supporting evidence.

    Explanation: The guide says: "You may use your own template as long as the information is presented in a structured, professional manner and follows all other requirements outlined above." A custom template does not waive the evidence and narrative requirements.

    Reference: OSTH Exam Guide — Section 2 / Suggested Documentation Templates